stunnel Unable to Locate Log File

2

I have built an alpine linux docker container on 3.11.6 w/ NGINX, Node.js, and stunnel When I go to load stunnel by calling stunnel inside of the running container I get that it cannot find the log file /var/log/stunnel/stunnel.log but the file does exist in the container and it is writable/readable.

$ bash-5.0# stunnel
[ ] Clients allowed=500
[.] stunnel 5.56 on x86_64-alpine-linux-musl platform
[.] Compiled with OpenSSL 1.1.1d  10 Sep 2019
[.] Running  with OpenSSL 1.1.1g  21 Apr 2020
[.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,OCSP,PSK,SNI
[ ] errno: (*__errno_location())
[.] Reading configuration from file /etc/stunnel/stunnel.conf
[.] UTF-8 byte order mark not detected
[ ] No PRNG seeding was required
[ ] Initializing service [fb-live]
[ ] Ciphers: HIGH:!aNULL:!SSLv2:!DH:!kDHEPSK
[ ] TLSv1.3 ciphersuites: TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256
[ ] TLS options: 0x02100004 (+0x00000000, -0x00000000)
[ ] Loading certificate from file: /certs/cert.pem
[ ] Certificate loaded from file: /certs/cert.pem
[ ] Loading private key from file: /certs/key.pem
[ ] Private key loaded from file: /certs/key.pem
[ ] Private key check succeeded
[:] Service [fb-live] needs authentication to prevent MITM attacks
[.] Configuration successful
[ ] Binding service [fb-live]
[ ] Listening file descriptor created (FD=9)
[ ] Setting accept socket options (FD=9)
[ ] Option SO_REUSEADDR set on accept socket
[ ] Service [fb-live] (FD=9) bound to 0.0.0.0:1936
[!] Cannot open log file: /var/log/stunnel/stunnel.log
[ ] Deallocating section defaults
[ ] Unbinding service [fb-live]
[ ] Service [fb-live] closed (FD=9)
[ ] Service [fb-live] closed
[ ] Deallocating section [fb-live]

$ bash-5.0# find . -name *stunnel*
./usr/lib/stunnel
./usr/lib/stunnel/libstunnel.so
./usr/bin/stunnel3
./usr/bin/stunnel
./var/log/stunnel
./var/log/stunnel/stunnel.log
./var/lib/stunnel
./etc/stunnel
./etc/stunnel/stunnel.conf
./etc/default/stunnel
./run/stunnel

$ bash-5.0# ls /var/log/stunnel/stunnel.log -lash
     0 -rw-rw----    1 root     root           0 Oct  9 17:25 /var/log/stunnel/stunnel.log
bash-5.0# 

I've tried moving the file path around to different directories to inside of the bin, inside of /var/run/stunnel but nothing sees to allow it to open it. I believe this is why stunnel doesn't load up properly.

$ grep setuid /etc/stunnel/stunnel.conf
setuid = stunnel
stunnel
asked on Server Fault Oct 9, 2020 by object Object • edited Oct 10, 2020 by object Object

1 Answer

1

Thanks to @kubanczyk for the assist here. The stunnel user did not have access to read / write to the files. I ended up running

$ chown -R stunnel:stunnel var/log/stunnel/stunnel.log
$ chown -R stunnel:stunnel var/run/stunnel/

This allowed stunnel to access the files and boot properly.

answered on Server Fault Oct 10, 2020 by object Object

User contributions licensed under CC BY-SA 3.0